Lucene search

[email protected]NVD:CVE-2023-22933

HistoryFeb 14, 2023 - 6:15 p.m.

CVE-2023-22933

2023-02-1418:15:12

CWE-79

[email protected]

web.nvd.nist.gov

splunk enterprise

cross-site scripting

xml view

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.4%

JSON

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’.

Affected configurations

NVD

Node

splunksplunkRange8.1.0–8.1.13enterprise

splunksplunkRange8.2.0–8.2.10enterprise

splunksplunkRange9.0.0–9.0.4enterprise

splunksplunk_cloud_platformRange<9.0.2209

References

advisory.splunk.com/advisories/SVD-2023-0203

research.splunk.com/application/9ac2bfea-a234-4a18-9d37-6d747e85c2e4

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.4%

JSON

Related for NVD:CVE-2023-22933

nessus1 cvelist1 prion1 cve1